• I'm using rsync to deploy some static HTML that is going to be served by nginx.
  • The user that is running rysnc is "jenkins"
  • nginx is using the www-data group to access the folder.
  • jenkins is member of www-data

I ssh onto the Ubuntu 14.04 server in question and run

sudo chown -R jenkins:www-data /home/jenkins/thesite

then from another machine I run

rsync -rtzh --delete --omit-dir-times _site/ jenkins@the_server.com:/home/jenkins/thesite

When that has finished some (but not all) of the files now have their group set to jenkins. So nginx can't access them.

It doesn't seem to just be the files I've changed that have the permission issue but I'm generating the files using Jekyll which might impact or could just be a massive red herring.

In the Windows world I'd set the permissions on the parent folder and tell it to make children inherit. Is there a Linux equivalent or am I doing something silly with rsync?


There are at least a couple of ways to solve this issue. But first let me try and explain how the Linux/Unix world of permissions corresponds to the Windows world.

windows has inheritable permissions; Linux systems traditionally don't (but can with ACLs, which I'll ignore for now). Linux permissions are split in to three: owner, group, and everyone else ("other"). Each can have read, write, and execute (files) / search (folders). A file's owner is its creator. The group can be set by the owner to any group of which the owner is a member.

With rsync, what you need to try and achieve is the following

  1. Owner is jenkins (I assume you can't change that)
  2. Group is www-data (so that we can ensure nginx can read the files)
  3. Permissions on the target for files are user:read+write, group:read, other:read, and for folders user:read+write+search ("execute"), group:read+search, other:read+search. We can remove other permisions if you prefer

We will assume that existing files match the criteria, because you can fix those like this:

chown -R jenkins:www-data /home/jenkins/thesite
chmod -R u+rw,g=u,g+s,o=u /home/jenkins/thesite

Now for the rsync command we need to ignore the Windows file permissions and apply our own criteria:

rsync -rptzh --delete --omit-dir-times --chmod=u+rw,go=rX,Dg+s _site/ jenkins@the_server.com:/home/jenkins/thesite

The chmod flags for rsync are as follows:

  • u=rw - owner ("user") is to have (at least) read and write permissions
  • go-rX - group and everyone else ("other") are to have write permission removed
  • Dg+s - add the group-setgid bit to folders ("Directories") so that the group name is inherited from the root of the tree
  • thanks... those permissions don't work since it's still replacing the group with jenkins. But I've used chmod to set 755 which is allowing nginx to read even though the group is set to jenkins... is that a big ol' security hole? Jan 27 '15 at 22:49
  • Did you run the initial chmod/chown commands to set the correct group? You really ought to avoid 755 permissions because that sets files as executable. Nginx will be able to read the files even if the group is set incorrectly because we set "other" permissions to be as relaxed as the group permissions.
    – roaima
    Jan 27 '15 at 22:52
  • running through exactly as above I get rsync: Invalid argument passed to --chmod (Dg+s,go=u,go-w) Jan 27 '15 at 23:38
  • so rsync -rtzh --delete --omit-dir-times --perms --chmod=Dg+s,u+rwX,g+rX,o=rX works for me... which I think means the user can do whatever they want, everyone else can navigate the folder tree and read the files. Ok? Jan 27 '15 at 23:46
  • Ah, yes. Further investigation shows that I should have given you --perms --chmod=u+rw,go=rX,Dg+s, which works as I intended. (Change the g+s to g+ws if you want directories to be group-writable.) If this permissions string works for you now I'll update my answer to reflect the corrected value.
    – roaima
    Jan 28 '15 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.